Návody na nastavení fail2ban ke službám SOGo, PHPmyadmin, OwnCloud, Joomla a apache chybovým které chcete ochránit před útoky hrubou silou.

SOGO

/etc/fail2ban/filter.d/sogo-auth.conf
[Definition]
failregex = ^ sogod \[\d+\]: SOGoRootPage Login from '<HOST>' for user '.*' might not have worked( - password policy: \d*  grace: -?\d*  expire: -?\d*  bound: -?\d*)?\s*$
ignoreregex =

/etc/fail2ban/jail.d/sogo.local
[sogo]
enabled     = true
filter      = sogo-auth
action      = iptables-multiport[name=sogo, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath     = /var/log/sogo/sogo.log

vi /etc/sogo/sogo.conf
odkomentovat
WOLogFile = /var/log/sogo/sogo.log;

doporučuji nastavit
SOGoTimeZone = //"America/New_York, Europe/Berlin, Asia/Tokyo or Africa/Lubumbashi"

systemctl restart sogod fail2ban








phpmyadmin
https://blog.louwii.com/2017/01/secure-phpmyadmin-install-with-fail2ban/

vi /usr/share/phpMyAdmin/libraries/plugins/auth/AuthenticationCookie.class.php
    public function authFails()
    {
        global $conn_error;

        // Deletes password cookie and displays the login form
        $GLOBALS['PMA_Config']->removeCookie('pmaAuth-' . $GLOBALS['server']);

        $conn_error = $this->getErrorMessage();

        // needed for PHP-CGI (not need for FastCGI or mod-php)
        header('Cache-Control: no-store, no-cache, must-revalidate');
        header('Pragma: no-cache');
error_log('phpmyadmin: authentification failed');

        $this->auth();
    }


/etc/fail2ban/filter.d/phpmyadmin.conf
[Definition]
failregex = .*\[client <HOST>:[0-9]+\] phpmyadmin: authentification failed.*
ignoreregex =

/etc/fail2ban/jail.d/phpmyadmin.local
[phpmyadmin]
enabled     = true
filter      = phpmyadmin
action      = iptables-multiport[name=nginx, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath     = /var/log/httpd/error_log
              /var/log/httpd/ssl_error_log

systemctl restart fail2ban httpd














OwnCloud

vi /etc/fail2ban/filter.d/owncloud.conf
[Definition]
failregex={"reqId":".*","level":2,"time":".*","remoteAddr":".*","user":".*","app":"core","method":"POST","url":".*","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)"}

vi /etc/fail2ban/jail.d/owncloud.local

[owncloud]
enabled     = true
filter      = owncloud
action      = iptables-multiport[name=nginx, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath     = /var/www/html/owncloud/data/owncloud.log

systemctl restart fail2ban









Joomla

vi /etc/fail2ban/filter.d/joomla.local
[Definition]
failregex = ^.*INFO <HOST>.*joomlafailure.*

vi /etc/fail2ban/jail.d/joomla.conf
[joomla]
enabled = true
filter = joomla
port = iptables-multiport[name=nginx, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath = /var/www/html/web/logs/error.php

systemctl restart fail2ban



Apache error

[Definition]
failregex = (?P<host>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}) .+ 404 [0-9]+ "


vi /etc/fail2ban/jail.d/apache-error.local
[apache-error]
enabled     = true
filter      = apache-error
action      = iptables-multiport[name=nginx, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp]
logpath     = /var/log/httpd/access_log
              /var/log/httpd/ssl_access_log
maxretry    = 20

systemctl restart fail2ban





Výpis všech aktivních skupin
fail2ban-client status

Výpis některé ze skupin
fail2ban-client status phpmyadmin
Status for the jail: phpmyadmin
|- Filter
|  |- Currently failed: 1
|  |- Total failed: 1
|  `- File list:    /var/log/httpd/error_log /var/log/httpd/ssl_error_log
`- Actions
   |- Currently banned: 1
   |- Total banned: 1
   `- Banned IP list: 1.2.3.4

Odbanování pro ip 1.2.3.4
fail2ban-client set phpmyadmin unbanip 1.2.3.4


vi /etc/fail2ban/jail.local
[DEFAULT]
# time is in seconds. 3600 = 1 hour, 86400 = 24 hours (1 day)
findtime    = 3600
bantime     = 2592000
maxretry    = 5
ignoreip    = 127.0.0.1 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16